The fix, in one snippet
HTTP 500
{"error":"Request failed","reference":"…"}Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
Scan.now matches established traceback and exception formats in the baseline response.
Why it matters
Detailed errors reveal frameworks, source paths, functions and occasionally secrets that make exploitation faster.
How to fix it
Disable debug mode in production, return a generic reference to visitors and send full details only to access-controlled logs.
Where this fits
Stack trace or runtime exception exposed is check 9 of 18 that the error disclosure scanner runs under exposed files and information disclosure, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits GraphQL schema introspection exposed (medium), where an anonymous GraphQL schema-introspection query returned the endpoint schema. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Stack trace or runtime exception exposed closes one route in. Immediately below it: WordPress user enumeration via REST API, where the WordPress REST API or author archives reveal account usernames to anonymous visitors, giving attackers half of each credential pair before they start guessing passwords; WordPress xmlrpc.php enabled, where the WordPress XML-RPC endpoint at /xmlrpc.php is enabled; Exposed .DS_Store file, where a macOS .DS_Store file is served from the web root.
Found in the same scan
The error disclosure scanner reports this alongside checks from other categories that are at least as serious, including SQL injection, where a GET parameter produced a repeatable database-error or boolean-response SQL injection indicator, and Server-side request forgery, where a URL-like parameter caused the verified server to request a unique Scan.now callback. A single run of error disclosure scanner answers all of them at once.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Stack trace or runtime exception exposed (medium severity)
Scanner check id: sensitive-error-disclosureThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
